Steganographic method and device

ABSTRACT

An apparatus and method for encoding and decoding additional information into a stream of digitized samples in an integral manner. The information is encoded using special keys. The information is contained in the samples, not prepended or appended to the sample stream. The method makes it extremely difficult to find the information in the samples if the proper keys are not possessed by the decoder. The method does not cause a significant degradation to the sample stream. The method is used to establish ownership of copyrighted digital multimedia content and provide a disincentive to piracy of such material.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.08/999,766, filed Jul. 23, 1997, now U.S. Pat. No. 7,568,100, which is adivision of U.S. patent application Ser. No. 08/775,216, filed Dec. 31,1996, now U.S. Pat. No. 5,687,236, which is a continuation of U.S.patent application Ser. No. 08/489,172, filed Jun. 7, 1995, now U.S.Pat. No. 5,613,004.

DEFINITIONS

Several terms of art appear frequently in the following. For ease ofreference they are defined here as follows:

“Content” refers to multimedia content. The term encompasses the varioustypes of information to be processed in a multimedia entertainmentsystem. Content specifically refers to digitized audio, video or stillimages in the context of this discussion. This information may becontained within files on a multimedia computer system, the files havinga particular format specific to the modality of the content (sound,images, moving pictures) or the type of systems, computer or otherwise,used to process the content.

“Digitized” refers to content composed of discrete digital samples of anotherwise analog media, which approximate that media inside a computeror other digital device. For instance, the sound of music occursnaturally, and is experienced by humans as an analog (continuous) soundwave. The sound can be digitized into a stream of discrete samples, ornumbers, each of which represents an approximate value of the amplitudeof the real analog wave at a particular instant in time. These samplescan be stored in files in a computer and then used to recreate theoriginal sound wave to a high degree of accuracy. In general, contententering a digital system is digitized by Analog to Digital converters(A/D) and analog media are recreated by the digital system using aDigital to Analog (D/A) converter. In the context of this discussioncontent is always digitized content.

“Cryptography” is a field covering numerous techniques for scramblinginformation conveying messages so that when the message is conveyedbetween the sender and receiver an unintended party who intercepts thismessage cannot read it, or extract useful information from it.

A “Public Key Cryptosystem” is a particular cryptographic system whereall parties possess pairs of keys for encryption and decryption. Partiesto this type of system freely distribute their public keys, which othermay use to encrypt messages to the owner of the public key. Suchmessages are decrypted by the receiver with the private key. Privatekeys are never distributed. A message encrypted with a public key canonly be decrypted with the corresponding private key, and vice versa. Amessage encrypted with a private key is said to have been signed by theowner of that key. Anyone in possession of the public key may decryptthe message and known that it was encrypted, and thus signed, by theowner of the public key, since only they possess the correspondingprivate key.

“Steganography” is a field distinguished from cryptography, butassociated with it, that covers numerous methods for hiding aninformational message within some other medium, perhaps anotherunrelated message, in such a manner that an unintended party whointercepts the medium carrying the hidden message does not know itcontains this hidden message and therefore does not obtain theinformation in the hidden message. In other words, steganography seeksto hide messages in plain view.

BACKGROUND OF THE INVENTION

In the current environment of computer networks and the proliferation ofdigital or digitized multimedia content which may be distributed oversuch networks, a key issue is copyright protection. Copyright protectionis the ability to prevent or deter the proliferation of unauthorizedcopies of copyrighted works. It provides a reasonable guarantee that theauthor of a copyrighted work will be paid for each copy of that work.

A fundamental problem in the digital world, as opposed to the world ofphysical media, is that a unlimited number of perfect copies may be madefrom any piece of digital or digitized content. A perfect copy meansthat if the original is comprised of a given stream of numbers, then thecopy matches the original, exactly, for each number in the stream. Thus,there is no degradation of the original signal during the copyoperation. In an analog copy, random noise is always introduced,degrading the copied signal.

The act of making unlicensed copies of some content, digital or analog,whether audio, video, software or other, is generally known as piracy.Piracy has been committed for the purpose of either profit from the saleof such unlicensed copies, or to procure for the “pirate” a copy of thecontent for personal use without having paid for it.

The problem of piracy has been made much worse for any type of contentby the digitization of content. Once content enters the digital domain,an unlimited number of copies may be made without any degradation, if apirate finds a way to break whatever protection scheme was establishedto guard against such abuses, if any. In the analog world, there isgenerally a degradation in the content (signal) with each successivecopy, imposing a sort of natural limit on volume of piracy.

To date, three general types of schemes have been implemented in anattempt to protect copyrights.

-   1) Encryption-   2) Copy Protection-   3) Content Extensions

Copy Protection and Content Extensions generally apply in the digitalworld only, while a scheme related to Encryption, commonly known asscrambling, may be applied to an analog signal. This is typical inanalog cable systems.

Encryption scrambles the content. Before the content is made ready fordelivery, whether on floppy disk, or over a network, it must beencrypted, or scrambled. Once the content has been encrypted, it cannotbe used until it is decrypted, or unscrambled. Encrypted audio datamight sound like incomprehensible screeching, while an encrypted pictureor video might appear as random patterns on a screen. The principle ofencryption is that you are free to make as many copies as you want, butyou can't read anything that makes sense until you use a special key todecrypt, and you can only obtain the key by paying for the content.

Encryption has two problems, however. 1) Pirates have historically foundways to crack encryption, in effect, obtaining the key without havingpaid for it; and 2) Once a single legitimate copy of some content hasbeen decrypted, a pirate is now free to make unlimited copies of thedecrypted copy. In effect, in order to sell an unlimited quantity of anencrypted piece of software, the pirate could simply buy one copy, whichthey are entitled to decrypt.

Copy Protection includes various methods by which a software engineercan write the software in a clever manner to determine if it has beencopied, and if so to deactivate itself. Also included are undocumentedchanges to the storage format of the content. Copy protection wasgenerally abandoned by the software industry, since pirates weregenerally just as clever as the software engineers and figured out waysto modify their software and deactivate the protection. The cost ofdeveloping such protection was not justified considering the level ofpiracy which occurred despite the copy protection.

Content Extension refers to any system which attaches some extrainformation to the original content which indicates whether or not acopy may be made. A software or hardware system must be specificallybuilt around this scheme to recognize the additional information andinterpret it in an appropriate manner. An example of such a system isthe Serial Copyright Management System embedded in Digital Audio Tape(DAT) hardware. Under this system, additional information is stored onthe disc immediately preceding each track of audio content whichindicates whether or not it can be copied. The hardware reads thisinformation and uses it accordingly.

A fundamental problem with Encryption and Content Extension is the“rogue engineer”. An employee who helped design such a system or anindividual with the knowledge and means to analyze such a system canmodify it to ignore the copyright information altogether, and makeunlicensed copies of the content. Cable piracy is quite common, aided byillicit decoder devices built by those who understand the technicaldetails of the cable encryption system. Although the cable systems inquestion were actually based on analog RF signals, the same principleapplies to digital systems.

The practical considerations of weak encryption schemes and rogueengineers have served to limit the faith which may be put in suchcopyright protection schemes. The invention disclosed herein serves toaddress these problems with conventional systems for digitaldistribution. It provides a way to enforce copyright online. Theinvention draws on techniques from two fields, cryptography, the art ofscrambling messages so that only the intended recipient may read them,and steganography, a term applied to various techniques for obscuringmessages so that only the intended parties to a message even know that amessage has been sent, thus it is termed herein as a stega-cipher. Thestega-cipher is so named because it uses the steganographic technique ofhiding a message in multimedia content, in combination with multiplekeys, a concept originating in cryptography. However, instead of usingthe keys to encrypt the content, the stega-cipher uses these keys tolocate the hidden message within the content. The message itself isencrypted which serves to further protect the message, verify thevalidity of the message, and redistribute the information in a randommanner so that anyone attempting to locate the message without the keyscannot rely on pre-supposed knowledge of the message contents as a helpin locating it.

SUMMARY OF THE INVENTION

The invention disclosed herein combines two techniques,steganography—obscuring information that is otherwise in plain sight,and cryptography—scrambling information that must be sent over unsecuredmeans, in a manner such that only the intended recipient maysuccessfully unscramble it. The net effect of this system is tospecifically watermark a piece of content so that if it is copied, it ispossible to determine who owned the original from which the copies weremade, and hence determine responsibility for the copies. It is also afeature of the system to uniquely identify the content to which it isapplied.

For a comprehensive discussion of cryptography, its theory, applicationsand specific algorithms, see APPLIED CRYPTOGRAPHY, by Bruce Schneier,which is herein incorporated by reference at pages 66-68, 387-392.

Steganography is discussed briefly in THE CODE BREAKERS by David Kahn,which is herein incorporated by reference at pages xiii, 81-83, 522-526,and 873. An example application, Stego by Romana Machado, is alsoavailable for the Apple Macintosh. Stego can be found at the internetuniform resource locator“ftp://sumex-aim.stanford.edu/infomac/cmp/stego10a2.hqx”. Thisapplication demonstrates in a simple steganographic technique to encodea text message into a graphical image without significantly distortingthe image.

The invention improves upon the prior art by providing a manner forprotecting copyright in the digital domain, which neither steganographyor cryptography does. It improves specifically on steganography bymaking use of special keys which dictate exactly where within a largerchunk of content a message is to be hidden, and makes the task ofextracting such a message without the proper key the equivalent oflooking for a needle in a haystack.

The information encoded by the Stega-Cipher process serves as awatermark which identifies individual copies of content legally licensedto specific parties. It is integral with the content. It cannot beremoved by omission in a transmission. It does not add any overhead tosignal transmission or storage. It does allow the content to be storedto and used with traditional offline analog and digital media, withoutmodification or significant signal degradation. These aspects of thestega-cipher all represent improvements to the art. That is, it forceswould be pirates to damage the content in order to guarantee thedisabling of the watermark.

The invention described herein is used for protecting and enforcingcopyrights in the digital or on-line domain, where there are no physicallimitations on copying copyrighted content.

The invention uniquely identifies every copy of multimedia content madeusing the invention, composed of digitized samples whether compressed oruncompressed, including but not limited to still digital images, digitalaudio, and digital video.

The invention is for use in meterware or pay-by-use systems where anonline user incurs a charge each time they access a particular piece ofcontent, or uses a software title.

The invention is for use as a general improvement to cryptographictechniques to increase the complexity of crytanalysis on a given cipher.

It is considered that the method and steps of the present invention willbe modified to account for the effects of lossy compression schemes onthe samples and particularly includes modification to handle MPEGcompressed audio and video.

It is considered that statistical data spreading and recoverytechniques, error coding or spread spectrum processing techniques mightbe applied in the invention to handle the effects of lossy compression,or counter the effects of a randomization attack.

It is considered that the apparatus described might be furtherspecialized and optimized in hardware by replacing general purpose databuses and CPU or DSP driven operations with hardwired circuitry,incorporated in one or more special purpose purpose ICs.

It is considered that the apparatus will be modeled and implemented insoftware on general purpose computer platforms.

It is considered that stega-cipher hardware could be embedded in aconsumer electronics device and used to not only identify content andcopyright, but to enable use of that content.

DETAILED DESCRIPTION I. Digital Copyright Stega-Cipher Protocol and theDecode/Encode Program

The purpose of the program described here is to watermark digitalmultimedia content for distribution to consumers through online servicesin such a way as to meet the following criteria

Given a unique piece of multimedia content, composed of digitizedsamples, it is desirable to:

-   1) Uniquely identify this particular piece of content from others in    a manner which is secure and undeniable (e.g. to known whether a    digital audio recording is “My Way” by Frank Sinatra, or “Stairway    to Heaven”, by Led Zeppelin), and in a manner such as this    identification can be performed automatically by an electronic    device or mechanism.-   2) Uniquely identify the copyright owner of the content, and the    terms under which it may be distributed in general, in a manner    which is secure and undeniable.-   3) At such time as is necessary, additionally, uniquely identify in    a secure and undeniable manner the licensed publisher who received a    particular copy of the content, and the terms under which they may    redistribute or resell it.-   4) At such time as is necessary, additionally, uniquely identify in    a secure and undeniable manner, the licensed subscriber who received    a particular copy of the content from the publisher described in    item 3.

The program described in more detail below combines the techniques ofcryptography and steganography to hide a securely encrypted digitalcopyright certificate which contains information satisfying the criterialisted above, in such a manner as to be integral with the content, likea watermark on paper, so that possession of the content dictatespossession of the watermark information. In addition, the watermarkcannot be “found” or successfully decoded, without possession of thecorrect “masks” or keys, available only to those legitimatelyauthorized, namely, those parties to a commercial transaction involvingthe sale of a copy of the content. Finally, the ability to distributesuch watermarked content in a system which implements the watermarkscheme is denied without a successfully decoded watermark. Because wellknown and tested cryptographic techniques are used to protect thecertificate itself, these certificates are virtually impossible toforge. Finally, the watermark cannot be erased without significantlydamaging the content.

The basic program represents a key part of the invention itself. Thisprogram is then used as the method by which copyright information is tobe associated in an integral manner with the content. This is a conceptabsent from copy protection, encryption and content extension schemes.The copyright information itself can be made undeniable and unforgeableusing cryptographic techniques, so that through it an audit trail ofownership may be established for each copy of a given piece of content,thus customizing each copy to a particular owner, in a way that can beused to identify the owner.

The value of the stega-cipher is that it provides a way to watermark thecontent in a way that changes it slightly, but does not impact humanperception significantly. And, furthermore, that it is made difficult todefeat since one must know exactly where the information resides toextract it for analysis and use in forgery attempts, or to remove itwithout overly degrading the signal. And, to try to force copyrightinformation one must first be able to analyze the encrypted copyrightinformation, and in order to do that, one must be able to find it, whichrequires masks.

II. Example Embodiment of General Processing

Digital audio data is represented by a series of samples in 1 dimension,

-   -   {S₁, S₂, S₃ . . . S_(n)}

This series is also referred to as a sample stream. The sample streamapproximates an analog waveform of sound amplitude over time. Eachsample represents an estimate of the wave amplitude at the instant oftime the sample is recorded. For monaural audio, there is one suchsample stream. Stereo audio is comprised of two sample streams, onerepresenting the right channel, and the other representing the left.Each stream is used to drive a corresponding speaker to reproduce thestereo sound.

What is referred to as CD quality audio is characterized by 16 bit (2byte) stereo samples, recorded at 44.1 Khz, or 44,100 samples per secondin each channel. The dynamic range of sound reproduction is directlyproportional to the number of bits per sample. Some lower qualityrecordings are done at 8 bits. A CD audio recording can be stored usingany scheme for containing the 2 sample streams in their entirety. Whenthese streams are played back at the same frequency they were recordedat, the sound recorded is reproduced to a high degree of accuracy.

The sample is processed in order from first sample to last. For thepurpose of the invention disclosed, the stream is separated into samplewindows, each of which has a fixed number of consecutive samples fromthe stream, and where windows do not overlap in the sample stream.Windows may be contiguous in the sample stream. In this discussionassume each window contains 128 samples, and that windows arecontiguous. So, the windows within the stream look like

-   -   {[S₁, S₂, S₃ . . . S₁₂₈], [S₁₂₉, S₁₃₀, S₁₃₁ . . . S₂₅₆], . . .        [S_(n-128) . . . S_(n)]}        where [ . . . ] denotes each window and any odd samples at the        end of the stream which do not completely fill a window can be        ignored, and simply passed through the system unmodified.

These windows will be used as input for the discrete Fast FourierTransform (and its inverse) operation.

Briefly, Fourier Transform methods are based on the principle that acomplex waveform, expressed as amplitude over time and represented by asample stream, is really the sum of a number of simple waveforms, eachof which oscillate at different frequencies.

By complex, it is meant that the value of the next sample is not easilypredicted from the values of the last N samples or the time of thesample. By simple it is meant that the value of the sample is easilypredictable from the values of the last N samples and/or the time of thesample.

The sum of multiple simple waves is equivalent to the complex wave. Thediscrete FFT and its inverse simply translate a limited amount of datafrom one side of this equivalence to the other, between the complexwaveform and the sum of simple waves. The discrete FFT can be used totranslate a series of samples representing amplitude over time (thecomplex wave, representing a digital audio recording) into the samenumber of samples representing total spectral energy in a given range offrequencies (the simple wave components) at a particular instant oftime. This instant is the time in the middle of the originalamplitude/time samples. The inverse discrete FFT translates the data inthe other direction, producing the complex waveform, from its simplerparts.

Each 128 sample window will be used as an input to the discrete FFT,resulting in 128 bins representing each of 128 frequency bands, rangingfrom 0 Hz to 22 Khz (the Nyquist frequency, or ½ the sampling rate).

Information can be encoded into the audio signal in the frequency domainor in the time domain. In the latter case, no FFT or inverse FFT isnecessary. However, encoding in the frequency domain is recommended,since its effects are scattered over the resultant time domain samples,and not easily predicated. In addition, frequency domain encoding makesit more likely that randomization will result in noticeable artifacts inthe resultant signal, and therefore makes the stega-cipher moredefensible against such attacks. It is in the frequency domain thatadditional information will be encoded into the audio signal for thepurpose of this discussion. Each frequency band in a given time slicecan potentially be used to store a small portion of some additionalinformation to be added to the signal. Since these are discreteestimates, there is some room for error which will not significantlyeffect the perceived quality of the signal, reproduced aftermodification, by the inverse FFT operation. In effect, intentionalchanges, which cannot be distinguished from random variations areintroduced in the frequency domain, for the purpose of storingadditional information in the sample stream.

These changes are minimized so as not to adversely affect the perceivedquality of the reproduced audio signal, after it has been encoded withadditional information in the manner described below. In addition, thelocation of each of these changes is made virtually impossible topredict, an innovation which distinguishes this scheme from simplesteganographic techniques.

Note that this process differs from the Nagata, et al. U.S. Pat. Nos.4,979,210 and 5,073,925, which encode information by modulating an audiosignal in amplitude/time domain. It also differs in that the modulationsintroduced in the Nagata process (which are at very low amplitude andfrequency relative to the carrier wave as to remain inaudible) carryonly copy/don't copy information, which is easily found and circumventedby one skilled in the art. Also, there is no limitation in thestega-cipher process at to what type of information can be encoded intothe signal, and there is more information storage capacity, since theencoding process is not bound by any particular frequency of modulationbut rather by the number of samples available. The granularity ofencoding in the stega-cipher is determined by the sample window size,with potentially 1 bit of space per sample or 128 bits per window (asecure implementation will halve this to 64 bits). In Nagata, et al. thegranularity of encoding is fixed by the amplitude and frequencymodulation limits required to maintain inaudibility. These limits arerelatively low, and therefore make it impractical to encode more thansimple copy/don't copy information using the Nagata process.

III. Example Embodiment of Encoding and Decoding

A modification to standard steganographic technique is applied in thefrequency domain described above, in order to encode additionalinformation into the audio signal.

In a scheme adapted from cryptographic techniques, 2 keys are used inthe actual encode and decode process. For the purposes of this inventionthe keys are referred to as masks. One mask, the primary, is applied tothe frequency axis of FFT results, the other mask is applied to the timeaxis (this will be called the convolution mask). The number of bitscomprising the primary mask are equal to the sample window size insamples (or the number of frequency bands computed by the FFT process),128 in this discussion. The number of bits in the convolution mask areentirely arbitrary. This implementation will assume a time mask of 1024bits. Generally the larger the key, the more difficult it is to guess.

Prior to encoding, the primary and convolution masks described above aregenerated by a cryptographically secure random generation process. It ispossible to use a block cipher like DES in combination with asufficiently pseudo-random seed value to emulate a cryptographicallysecure random bit generator. These keys will be saved along withinformation matching them to the sample stream in question in a databasefor use in decoding, should that step become necessary.

Prior to encoding, some additional information to be encoded into thesignal is prepared and made available to the encoder, in a bitaddressable manner (so that it may be read one bit at a time). If thesize of the sample stream is known and the efficiency characteristics ofthe stega-cipher implementation are taken into account, a known limitmay be imposed on the amount of this additional information.

The encoder captures one sample window at a time from the sample stream,in sequential, contiguous order. The encoder tracks the sequentialnumber of each window it acquires. The first window is 0. When thenumber of windows processed reaches the number of bits in the windowmask, minus one, the next value of the window counter will be reset to0.

This counter is the convolution index or phase. In the currentimplementation it is used as a simple index into the convolutionbitmask. In anticipated developments it will be used to performconvolution operations on the convolution mask to determine which bit touse. For instance the mask might by rotated by a number corresponding tothe phase, in bits to the left and XORed with the primary mask toproduce a new mask, which is then indexed by the phase. There are manypossibilities for convolution.

The encoder computes the discrete FFT of the sample window.

Starting with the lowest frequency band, the encoder proceeds througheach band to the highest, visiting each of the 128 frequency bands inorder. At each band value, the encoder takes the bit of the primary maskcorresponding to the frequency band in question, the bit of theconvolution mask corresponding to the window in question, and passesthese values into a boolean function. This function is designed so thatit has a near perfectly random output distribution. It will return truefor approximately 50% of its input permutations, and false for the other50%. The value returned for a given set of inputs is fixed, however, sothat it will always return the same value given the same set of inputs.

If the function returns true, the current frequency band in the currentwindow is used in the encoding process, and represents a valid piece ofthe additional information encoded in the signal. If the functionreturns false, this cell, as the frequency band in a given window iscalled, is ignored in the process. In this manner it is made extremelydifficult to extract the encoded information from the signal without theuse of the exact masks used in the encoding process. This is one placein which the stega-cipher process departs from traditionalsteganographic implementations, which offer a trivial decode opportunityif one knows the information is present. While this increases theinformation storage capacity of the carrier signal, it makes decodingtrivial, and further degrades the signal. Note that it is possible anddesirable to modify the boolean cell flag function so that it returnstrue <50% of the time. In general, the fewer cells actually used in theencode, the more difficult they will be to find and the less degradationof content will be caused, provided the function is designed correctly.There is an obvious tradeoff in storage capacity for this increasedsecurity and quality.

The encoder proceeds in this manner until a complete copy of theadditional information has been encoded in the carrier signal. It willbe desirable to have the encoder encode multiple copies of theadditional information continuously over the duration of the carriersignal, so that a complete instance of this information may be recoveredfrom a smaller segment of a larger signal which has been split intodiscontinuous pieces or otherwise edited. It is therefore desirable tominimize the size of the information to be encoded using both compactdesign and pre-encoding compression, thus maximizing redundant encoding,and recoverability from smaller segments. In a practical implementationof this system it is likely the information will be first compressed bya known method, and then encrypted using public-key techniques, beforebeing encoded into the carrier signal.

The encoder will also prepare the package of additional information sothat it contains an easily recognizable start of message delimeter,which can be unique to each encoding and stored along with the keys, toserve as a synchronization signal to a decoder. The detection of thisdelimeter in a decoding window signifies that the decoder can bereasonably sure it is aligned to the sample stream correctly and canproceed in a methodic window by window manner. These delimeters willrequire a number of bits which minimizes the probability that this bitsequence is not reproduced in a random occurrence, causing an accidentalmisaligment of the decoder. A minimum of 256 bits is recommended. In thecurrent implementation 1024 bits representing a start of messagedelimeter are used. If each sample is random, then each bit has a 50%probably of matching the delimeter and the conditional probability of arandom match would be ½¹⁰²⁴. In practice, the samples are probablysomewhat less than random, increasing the probability of a matchsomewhat.

The decode process uses the same masks in the same manner, only in thiscase the information is extracted one bit at a time from the carriersignal.

The decoder is assumed to have access to the proper masks used to encodethe information originally. These masks might be present in a database,which can be indexed by a value, or values computed from the originalcontent, in a manner insensitive to the modifications to the contentcaused by the stega-cipher process. So, given an arbitrary piece ofcontent, a decoder might first process the content to generate certainkey values, and then retrieve the decode masks associated with thematching key values from the database. In the case where multiplematches occur, or none are found, it is conceivable that all mask setsin the database could be tried sequentially until a valid decode isachieved, or not, indicating no information is present.

In the application of this process, it is anticipated that encodingoperations may be done on a given piece of content up to 3 times, eachadding new information and using new masks, over a sub-segment of thecontent, and that decode operations will be done infrequently. It isanticipated that should it become necessary to do a search of a largenumber of masks to find a valid decode, that this process can beoptimized using a guessing technique based on close key matching, andthat it is not a time critical application, so it will be feasible totest large numbers of potential masks for validity on a given piece ofcontent, even if such a process takes days or weeks on powerfulcomputers to do a comprehensive search of known mask sets.

The decode process is slightly different in the following respect.Whereas the encoding process can start at any arbitrary point in thesample stream, the decode process does not known where the encodeprocess began (the exact offset in samples to the start of the firstwindow). Even though the encode process, by convention, starts withsample 0, there is no guarantee that the sample stream has not beenedited since encoding, leaving a partial window at the start of thesample stream, and thus requiring the decoder to find the first completewindow to start the decode. Therefore, the decode process will start atthe first sample, and shift the sample window along by 1 sample, keepingthe window index at 0, until it can find a valid decode delimeterencoded in the window. At this point, the decoder knows it hassynchronized to the encoder, and can then proceed to process contiguouswindows in a more expedient manner.

Example Calculations based on the described implementations for addingcopyright certificate information to CD quality digital audio:

In a stream of samples, every 128 samples will contain, on average 64bits of certificate related information. Digital audio is composed of 16bit samples, at 44.1 Khz, or 44,100 samples per second. Stereo audioprovides 2 streams of information at this rate, left and right, or88,200 samples per second. That yields approximately 689 contiguoussample windows (of 128 samples) per second in which to encodeinformation. Assume a song is 4 minutes long, or 240 seconds. Thisyields 240*689=165,360 windows, which on average (50% utilization)contain 64 bits (8 bytes) each of certificate information. This in turngives approximately 1291 Kb of information storage space per 4 minutestereo song (1.2 MB). There is ample room for redundant encoding ofinformation continuously over the length of the content. Encoding 8bytes for every 256 bytes represents 3.1% of the signal information.Assuming that a copyright certificate requires at most approximately2048 bytes (2K), we can encode the same certificate in 645 distinctlocations within the recording, or approximately every 37/100ths of asecond.

Now to account for delimeters and synchronization information. Assuminga sync marker of 1024 bits to avoid random matches, then we could prefixeach 2K certificate block with this 1024 bit marker. It takes 256windows to store 2K, and under this proposed scheme, the first 16windows are reserved for the sync marker. A decoder could search forthis marker by progressively matching each of the first 16 windows (64bits at a time) against the corresponding portion of the sync marker.The decoder could reset the match advancing through the sample stream,as soon as one window did not conform to the sync marker. and proceed inthis manner until it matches 16 consecutive windows to the marker, atwhich point it is synchronized.

Under this scheme, 240 windows, or 1.92K remain for storing certificateinformation, which is not unreasonable.

IV. Possible Problems, Attacks and Subsequent Defenses

-   A. Randomization

The attacker simply randomizes the least significant bits of each datapoint in the transform buffer, obliterating the synchronization signaland the watermark. While this attack can remove the watermark, in thecontext in which stega-cipher is to be used, the problem of piracy iskept to a minimum at least equal to that afforded by traditional media,since the system will not allow an unwatermarked piece of content to betraded for profit and watermarks cannot be forged without the properkeys, which are computationally difficult to obtain by brute-force orcrytanalysis. In addition, if the encoding is managed in such a way asto maximize the level of changes to the sample stream to be just at thethreshold below human perception, and the scheme is implemented toanticipate randomization attempts, it is possible to force therandomization level to exceed the level that can be perceived and createdestructive artifacts in the signal, in much the same manner as a VHScassette can be manufactured at a minimal signal level, so that a singlecopy results in unwatchable static.

-   B. Low Bit-Depth Bitmaps (Black & White Images)

These bitmaps would be too sensitive to the steganization process,resulting in unacceptable signal degradation, and so are not goodcandidates for the stega-cipher process. The problem may be circumventedby inflating bit-depth, although this is an inefficient use of space andbandwidth.

-   C. Non-Integer Transforms

The FFT is used to generate spectral energy information for a givenaudio signal. This information is not usually in integer format.Computers use methods of approximation in these cases to represent thereal numbers (whole numbers plus fractional amounts). Depending on theexact value of the number to be represented slight errors, produced byrounding off the nearest real number that can be completely specified bythe computer occur. This will produce some randomization in the leastsignificant bit or bits. In other words, the same operation on the samesample window might yield slightly different transform values each time.It is possible to circumvent this problem using a modification to thesimple LSB steganographic technique described later. Instead of lookingat the LSB, the stega-cipher can use an energy quantization technique inplace of the LSB method. Some variant of rounding the spectral energyvalues up or down, with a granularity greater than the rounding errorshould work, without significantly degrading the output samples.

V. A Method and Protocol for Using the Stega-Cipher

The apparatus described in the claims below operates on a window bywindow basis over the sample stream. It has no knowledge of the natureof the specific message to be encoded. It merely indexes into a bitstream, and encodes as many of those bits as possible into a givensample window, using a map determined by the given masks.

The value of encoding information into a single window in the samplestream using such an apparatus may not be inherently apparent until oneexamines the manner in which such information will be used. The protocoldiscussed in this section details how messages which exceed the encodingcapacity of a single sample window (128 samples) may be assembled fromsmaller pieces encoded in the individual windows and used to defendcopyrights in an online situation.

An average of 64 bits can be encoded into each window, which equals only8 bytes. Messages larger than 8 bytes can be encoded by simply dividingthe messages up and encoding small portions into a string of consecutivewindows in the sample stream. Since the keys determine exactly how manybits will be encoded per window, and an element of randomness isdesirable, as opposed to perfect predictability, one cannot be certainexactly how many bits are encoded into each window.

The start of each message is marked by a special start of messagedelimeter, which, as discussed above is 1024 bits, or 128 bytes.Therefore, if precisely 8 bytes are encoded per window, the first 16windows of any useable message in the system described here are reservedfor the start of message delimeter. For the encoder, this schemepresents little challenge. It simply designates the first sample windowin the stream to be window 0, and proceeds to encode the messagedelimeter, bit-by-bit into each consecutive window. As soon as it hasprocessed the last bit of the SOM delimeter it continues by encoding 32bits representing the size, in bytes of the complete message to follow.Once the 32nd and final bit of the size is encoded, the message itselfis encoded into each consecutive window, one bit at a time. Some windowsmay contain more encoded bits than others, as dictated by the masks. Asthe encoder processes each window in the content it increments itswindow counter. It uses this counter to index into the window mask. Ifthe number of windows required to encode a complete message is greaterthan the size of this mask, 256 bits in this case, or 256 windows, thenit simply resets the counter after window 255, and so on, until acomplete message is encoded. It can then start over, or start on a newmessage.

The decoder has a bigger challenge to face. The decoder is given a setof masks, just like encoder. Unlike the encoder, the decoder cannot besure that the first series of 128 samples it receives are the window 0start of message, encoded by the decoder. The sample stream originallyproduced by an encoder may have been edited by clipping its endsrandomly or splicing pieces together. In that case, the particular copyof the message that was clipped is unrecoverable. The decoder has thestart of message delimeter used to encode the message that the decoderis looking for. In the initial state, the decoder assumes the firstwindow it gets is window 0. It then decodes the proper number of bitsdictated by the masks it was given. It compares these bits to thecorresponding bits of the start of message delimeter. If they match, thedecoder assumes it is still aligned, increments the window counter andcontinues. If the bits do not match, the decoder knows it is notaligned. In this case, it shifts once more sample onto the end of thesample buffer, discarding the first sample, and starts over. The windowcounter is set to 0. The decoder searches one sample at a time for analignment lock. The decoder proceeds in this manner until it has decodeda complete match to the start of message delimeter or it exhausts thesample stream without decoding a message. If the decoder can matchcompletely the start of message delimeter bit sequence, it switches intoaligned mode. The decoder will now advance through the sample stream afull window at a time (128 samples). It proceeds until it has the 32bits specifying the message size. This generally won't occupy more than1 complete window. When the decoder has locked onto the start of messagedelimeter and decoded the message size, it can now proceed to decode asmany consecutive additional windows as necessary until it has decoded acomplete message. Once it has decoded a complete message, the state ofthe decoder can be reset to un-synchronized and the entire process canbe repeated starting with the next 128 sample window. In this manner itis not absolutely necessary that encoding windows be contiguous in thesample stream. The decoder is capable of handling random intervalsbetween the end of one message and the start of another.

It is important to note that the circuit for encoding and decoding asample window does not need to be aware of the nature of the message, orof any structure beyond the start of message delimeter and message size.It only needs to consider a single sample window, its own state (whetherthe decoder is misaligned, synchronizing, or synchronized) and what bitsto encode/decode.

Given that the stega-cipher apparatus allows for the encoding anddecoding of arbitrary messages in this manner, how can it be used toprotect copyrights?

The most important aspect of the stega-cipher in this respect is thatfact that it makes the message integral with the content, and difficultto remove. So it cannot be eliminated simply by removing certaininformation prepended or appended to the sample stream itself. In fact,removing an arbitrary chunk of samples will not generally defeat thestega-cipher either.

Given that some information can thus be integrated with the contentitself, the question is then how best to take advantage of thisarrangement in order to protect copyrights.

The following protocol details how the stega-cipher will be exploited toprotect copyrights in the digital domain.

In a transaction involving the transfer of digitized content, there areat least 3 functions involved:

The Authority is a trusted arbitrator between the two other functionslisted below, representing parties who actually engage in the transferof the content. The Authority maintains a database containinginformation on the particular piece of content itself and who the twoparties engaged in transferring the content are. The Authority canperform stega-cipher encoding and decoding on content.

The Publisher, or online distributor is the entity which is sending thecopyrighted content to another party. The Publisher can performstega-cipher encoding and decoding on content.

The Consumer is the person or entity receiving the copyrighted content,generally in exchange for some consideration such as money. The consumercannot generally perform stega-cipher encoding or decoding on content.

Each of these parties can participate in a message exchange protocolusing well known public-key cryptographic techniques. For instance, asystem licensing RSA public key algorithms might be used for signed andencrypted message exchange. This means that each party maintains apublic key/private key pair, and that the public keys of each party arefreely available to any other party. Generally, the Authoritycommunicates via electronic links directly only to the Publisher and theConsumer communicates directly only with the publisher.

Below is an example of how the protocol operates from the time a pieceof content enters an electronic distribution system to the time it isdelivered to a Consumer.

A copyright holder (an independent artist, music publisher, moviestudio, etc.) wishes to retail a particular title online. For instance,Sire Records Company might wish to distribute the latest single fromSeal, one of their musical artists, online. Sire delivers a master copyof this single, “Prayer for the Dying”, to the Authority, Ethical Inc.Ethical converts the title into a format suitable for electronicdistribution. This may involve digitizing an analog recording. The titlehas now become content in the context of this online distributionsystem. The title is not yet available to anyone except Ethical Inc.,and has not yet been encoded with the stega-cipher watermark. Ethicalgenerates a Title Identification and Authentication (TIA) certificate.The certificate could be in any format. In this example it is a shorttext file, readable with a small word-processing program, which containsinformation identifying

-   the title-   the artist-   the copyright holder-   the body to which royalties should be paid-   general terms for publishers' distribution-   any other information helpful in identifying this content

Ethical then signs the TIA with its own private key, and encrypts theTIA certificate plus its signature with its own public key. Thus, theEthical can decrypt the TIA certificate at a later time and know that itgenerated the message and that the contents of the message have not beenchanged since generation.

Sire Records, which ultimately controls distribution of the content,communicates to the Ethical a specific online Publisher that is to havethe right of distribution of this content. For instance, Joe's OnlineEmporium. The Authority, Ethical Inc. can transmit a short agreement theDistribution Agreement to the Publisher, Joe's Online Emporium whichlists

-   the content title-   the publisher's identification-   the terms of distribution-   any consideration paid for the right to distribute the content-   a brief statement of agreement with all terms listed above

The Publisher receives this agreement, and signs it using its privatekey. Thus, any party with access to the Joe's Online Emporium's publickey could verify that Joe's signed the agreement, and that the agreementhas not been changed since Joe's signed it. The Publisher transmits thesigned Distribution Agreement to the Authority, Ethical Inc.

Ethical Inc. now combines the signed TIA certificate and theDistribution Agreement into a single message, and signs the entiremessage using its private key. Ethical has now created a PublisherIdentification message to go in its own stega-cipher channel into thecontent. Ethical Inc. now generates new stega-cipher masks and encodesthis message into a copy of the content using a stega-cipher encoder.The Authority saves the masks as a Receipt in a database, along withinformation on the details of the transfer, including the title, artistand publisher.

Ethical then transfers this watermarked copy to the Joe's OnlineEmporium, the Publisher. Well known encryption methods could be used toprotect the transfer between the Authority and the Publisher. TheAuthority may now destroy its copy, which the Publisher has received.The Publisher, Joe's Online Emporium now assumes responsibility for anycopies made to its version of the content, which is a Publisher Mastercopy.

Finally, the Consumer, John Q. Public wishes to purchase a copy of thecontent from Joe's Online Emporium. Joe's Emporium sends the John Q.Public a short agreement via an electronic communication link, similarto Publisher's Distribution Agreement, only this is a PurchaseAgreement, which lists

-   the content title-   consumer identification-   the terms of distribution-   the consideration pas for the content-   a brief statement of agreement with the terms above

John Q. Public signs this agreement with his private key and returns itto the Joe's Online Emporium. The Publisher, Joe's prepares to encodeits own stega-cipher watermark onto a copy of the content by generatinga set of masks for the algorithm. Joe's Online Emporium then storesthese masks (a receipt) in its own database, indexed by title andconsumer. Joe's Online Emporium signs the agreement received from JohnQ. Public with the Emporium's own private key, and forwards it to theAuthority, Ethical Inc., along with a copy of the masks. It is importantto note that this communication should be done over a secured channel.The Authority verifies the Publisher and Consumer information and addsit own signature to the end of the message, approving the transaction,creating a Contract of Sale. The Authority adds the Publisher's receipt(mask set) to its database, indexed by the title, the publisher, and theconsumer identification. The Authority signs the Contract of Sale byencrypting it with their private key. So anyone with the Authority'spublic key (any Publisher) could decrypt the Contract of Sale and verifyit, once it was extracted from the content. The Publisher then transmitsthe signed Contract of Sale back to the Publisher, who uses astega-cipher device to imprint this Contract as its own watermark overthe content. The Publisher then transmits the newly watermarked copy tothe Consumer, who is accepting responsibility for it. The Publisherdestroys their version of the consumer's copy.

If this procedure is followed for all content distribution within suchan online system then it should be possible for the Authority toidentify the owner of a piece of content which appears to beunauthorized. The Authority could simply try its database ofstega-cipher keys to decode the watermark in the content in question.For instance, if a copy of Seal's latest single originally distributedwith stega-cipher watermarks showed up on an Internet ftp site theAuthority should be able to extract a TIA Certificate and DistributionAgreement or a Contract of Sale identifying the responsible party. If aPublisher sold this particular copy to a Consumer, that particularpublisher should be able to extract a Contract of Sale, which placesresponsibility with the Consumer. This is not a time criticalapplication, so even if it takes days or weeks, it is still worthwhile.

In a modification to the protocol discussed above, each Publisher mightact as its own Authority. However, in the context of online services,this could open avenues of fraud committed by the collusion of certainPublishers and Consumers. Using an Authority, or one of severalavailable Authorities to keep records of Publisher-Consumer transactionsand verify their details decreases the likelihood of such events.

It should also be obvious that a similar watermarking system could beused by an individual entity to watermark its own content for its ownpurposes, whether online or in physical media. For instance, a CDmanufacturer could incorporate unique stega-cipher watermarks intospecific batches of its compact discs to identify the source of a piratering, or to identify unauthorized digital copies made from its discs.This is possible because the stega-cipher encoding works with theexisting formats of digital samples and does not add any new structuresto the sample data that cannot be handled on electronic or mechanicalsystems which predate the stega-cipher.

VI. Increasing Confidence in the Stega-Cipher

The addition of a special pre-encoding process can make stega-ciphercertificates even more secure and undeniable. Hash values may beincorporated which match exactly the content containing the watermark tothe message in the watermark itself. This allows us a verification thatthe watermark decoded was encoded by whomever signed it into thisprecise location in this specific content.

Suppose one wants to use a 256 bit (32 byte) hash value which iscalculated with a secure one-way hash function over each sample in eachsample window that will contain the message. The hash starts with a seedvalue, and each sample that would be processed by the encoder whenencoding the message is incorporated into the hash as it is processed.The result is a 256 bit number one can be highly confident is unique, orsufficiently rare to make intentionally duplicating it with anotherseries of samples difficult.

It is important that the hash function be insensitive to any changes inthe samples induced by the stega-cipher itself. For instance, one mightignore the least significant bit of each sample when computing the hashfunction, if the stega-cipher was implemented using a least significantbit encode mode.

Based on the size of the non-hash message, one knows the hash-inclusivemessage requires 32 more bytes of space. Once can now calculate the sizeof a signed encrypted copy of this message by signing and encryptingexactly as many random bytes as are in the message, and measuring thesize of the output in bytes. One now knows the size of the message to beencoded. One can pre-process the sample stream as follows.

Proceed through stega-cipher encode loop as described in the claims.Instead of encoding, however, calculate hash values for each windowseries which will contain the message, as each sample is processed. Atthe end of each instance of “encoding” take the resultant hash value anduse it to create a unique copy of the message which includes the hashvalue particular to the series of sample windows that will be used toencode the message. Sign and encrypt this copy of the message, and saveit for encoding in the same place in the sample stream.

A memory efficient version of this scheme could keep on hand theun-hashed message, and as it creates each new copy, back up in thesample stream to the first window in the series and actually encode eachmessage, disposing of its afterwards.

The important result is evident on decoding. The decoding party cancalculate the same hash used to encode the message for themselves, buton the encoded samples. If the value calculated by the decoding partydoes not match the value contained in the signed message, the decoder isalerted to the fact that this watermark was transplanted from somewhereelse. This is possible only with a hash function which ignores thechanges made by the stega-cipher after the hash in the watermark wasgenerated.

This scheme makes it impossible to transplant watermarks, even with thekeys to the stega-cipher.

APPENDIX Psuedo-code const int WINDOW-- RESET = 256; const int WINDOW--SIZE = 128; const int MARKER-- BITS = 1024; const int CHUNK-- BITS =2048 * 8; int window-- offset; int msg-- bit-- offset; int frequency--offset; Boolean useCell; /• 8 bits per bye, 1 byte per char */ unsignedchar frequency-- mask[WINDOW-- SIZE/8]; unsigned char window--mask[WINDOW-- RESET/8]; unsigned char msg-- start-- marker[MARKER--BITS/8]; unsigned char msg-- end-- marker[MARKER-- BITS/8]; Int16amplitude-- sample-- buffer[WINDOW-- SIZE]; float power-- frequency--buffer[WINDOW-- SIZE]; unsigned char message-- buffer[CHUNK-- BITS/8];void doFFT(Int16 *amp-- sample-- buffer, float *power-- freq--buffer,int size); void doInverseFFT(Int16 *amp-- sample-- buffer, float*power-- freq-- buffer,int size); void initialize( ); BitgetBit(unsigned char *buffer,int bitOffset); Boolean map(Bit window--bit, Bit band-- bit, int window, int frequency); BooleangetSamples(Int16 *amplitude-- sample-- buffer,int samples); void encode() void initialize( ) { /* message to be encoded is generated */ /*message is prefixed with 1024 bit msg-- start-- marker */ /* message issuffixed with 1024 bit msg-- end -- marker */ /* remaining space at endof message buffer padded with random bits */ window-- offset = 0; msg--bit-- offset = 0; frequency-- offset = 0; frequency-- mask loadedwindow-- mask loaded zeroAmpSampleBuffer( ); } Boolean getSamples(Int16*buffer,int samples) { /* get samples number of samples and shift themcontiguously into the sample buffer from right to left*/ if(samples <samples available) return false; else return true; } void doFFT(int16*sample-- buffer, float *spectrum-- buffer, int size) { calculate FFT onsample-- buffer, for size samples store result in spectrum buffer } voiddoInverseFFT(Int16 *sample-- buffer,float *spectrum-- buffer,int size) {calculate inverse FFT on spectrum-- buffer store result in sampe--buffer } Bit getBit(unsigned char *buffer,in bitOffset) { returns valueof specified bit in specified buffer either 0 or 1, could use Boolean(true/false) values for bit set of bit off } Boolean map(Bit window--bit,Bit band-- bit,int window, int frequency-- { /* this is the functionthat makes the information difficult to find */ /* the inputs window--bit and band-- bit depend only on the mask values used for encoding theinformation, they are 1) random, 2) secret */ /* window and frequencyvalues are used add time and frequency band dependent complexity to thisfunction */ /* this function is equivalent to a Boolean truth TABLE withwindow * frequency * 4 possible input combinations and 2 possible output*/ /* for any input combination, the output is either true or false *//* window ranges from 0 to WINDOW-- RESET −1 */ /* frequency ranges from0 to WINDOW-- SIZE − 1 */ return calculated truth value } voidencodeBit(float *spectrum-- buffer,int freq-- offset,Bit theBit) { /*modifies the value of the cell in spectrum-- buffer, indexed by freq--offset in a manner that distinguishes each of the 2 possible values oftheBit, 1 or 0 */ /* suggested method of setting the Least Significantbit of the cell == theBit */ /* alternative method of rounding the valueof the cell upward or downward to certain fractional values proposedi.e. <= .5 fractional remainder signifies 0, > .5 fraction remaindersignifies 1 */ } void encode( ) { initialize( ); do {if(getSamples(amplitude-- sample-- buffer) == false) returndoFFT(amplitude-- sample-- buffer,power-- frequency-- buffer,WINDOW--SIZE); for (frequency-- offset = 0; frequency-- offset < WINDOW-- SIZE;frequency-- offset++){ useCell = map(getBit(window-- mask,window--offset), getBit(frequency-- mask,frequency-- offset), window-- offset,frequency-- offset); if(useCell == true){ encodeBit(power-- frequency--buffer,frequency-- offset, getBit(message-- buffer,msg-- bit-- offset));message-- bit-- offset ++; if(msg-- bit-- offset MESSAGEBITS){initialize( ); break; /* exit frequency loop */ } } }doInverseFFT(amplitude-- sample-- buffer,power-- frequency -- buffer,WINDOW-- SIZE); outputSamples(amplitude-- sample-- buffer); window--offset++; if(window-- offset == WINDOW-- RESET){ window-- offset = 0; }} while(true); }

The encode( ) procedure processes an input sample stream using thespecified frequency and window masks as well as a pre-formatted messageto encode.

encode( ) processes the sample stream in windows of WINDOW—SIZE samples,contiguously distributed in the sample stream, so it advancesWINDOW—SIZE samples at a time.

For each sample window, encode( ) first compute the FFT of the window,yielding its Power Spectrum Estimation. For each of these windows PSEs,encode( ) then uses the map( ) function to determine where in each PSEto encode the bits of the message, which it reads from the messagebuffer, one bit at a time. Each time map( ) returns true, encode( )consumes another sample from the message.

After each window is encoded, encode( ) computes the inverse FFT on thePSE to generate a modified sample window, which is then output as themodified signal. It is important the sample windows NOT overlap in thesample stream, since this would potentially damage the precedingencoding windows in the stream.

Once the message is entirely encoded, including its special end ofmessage marker bit stream, encode( ) resets it internal variables tobeing encoding the message once more in the next window, encode( )proceeds in this manner until the input sample stream is exhausted.

enum { Synchronizing, Locked }; /* decode states */ unsigned charmessage-- end-- buffer[MARKER-- BITS]; Bit decodeBit(float *spectrum--buffer,int freq-- offset) /* reads the value of the cell in spectrum--buffer, indexed by freq-- offset in a manner that distinguishes each ofthe 2 possible values of an encoded bit, 1 or 0 */ /* suggested methodof testing the Least Significant bit of the cell */ /* alternativemethod of checking the value of the cell versus certain fractionalremainders proposed. i.e. <= .5 fractional remainder signifies 0, > .5fraction remainder signifies 1 */ return either 1 or 0 as appropriate }Boolean decode( ) { /* Initialization */ state = Synchronizing window--offset =0; set frequency mask set window mask clear sample buffer intnextSamples = 1; int msg-- start-- offset = 0; clear message-- end--buffer Bit aBit; Boolean bitsEqual; do { if(state == Synchronizing){nextSamples = 1; window-- offset = 0; } else nextSamples = WINDOW--SIZE; if(getSamples(amplitude-- sample-- buffer) == false) return false;doFFT(amplitude-- sample-- buffer,power-- frequency- - buffer, WINDOW--SIZE);/* 2 */ for (frequency-- offset = 0; frequency-- offset < WINDOW--SIZE; frequency-- offset++){ useCell = map(getBit(window-- mask,window--offset), getBit(frequency-- mask,frequency-- offset), window-- offset,frequency-- offset); if(useCell == true){ aBit = decodeBit(power--frequency-- buffer, frequency-- offset); setBit(message--buffer,message-- bit-- offset,aBit); message-- bit-- offset ++; } elsecontinue; if(state == Synchronizing){ bitsEqual = compareBits(message--start-- marker,message-- buffer, message-- bit-- offset);if(!bitsEqual){ message-- bit-- offset = 0; misaligned = true; break; /*exit frequency loop */ } else if (message-- bit-- offset == MARKER--BITS) state == Locked; } else { /* locked onto encoded stream */ shiftaBit into right side of message-- end-- buffer bitsEqual =compareBits(message-- end-- buffer, msg-- end-- marker,MARKER-- BITS);if(bitsEqual) return true; } } } while (true); }

The decode( ) procedure scans an input sample stream using specifiedwindow and frequency masks, until it either decodes a valid messageblock, storing it in a message buffer, or exhausts the sample stream.

The decode( ) procedure starts in state Synchronizing, in which it doesnot know where in the sample stream the encoding windows are aligned.The procedure advances the sample window through the sample stream onesample at a time, performing the FFT calculation on each window, andattempting to decode valid message bits from the window. As it extractseach bit using the map( ) function, the decode( ) procedure comparesthese bits against the start of message marker. As soon as a mismatch isdetected, the decode( ) procedure knows it is not yet properly alignedto an encoding window, and immediately ceases decoding bits from thecurrent window and moves to the next window, offset by 1 sample. Thedecode( ) procedure continues in this manner until it matchessuccessfully the complete bitstream of a start of message marker. Atthis point the decode( ) procedure assumes it is aligned to an encodedmessage and can then decode bits to the message buffer quickly,advancing the sample window fully at each iterations. It is now inLocked mode. For each bit it stores in the message buffer when in Lockedmode, the decode( ) procedure also shifts the same bit value into theleast significant bit of the message—end—buffer. After each bit isdecoded in Locked mode, the decode( ) procedure checks compares themessage—end—buffer with the msg—end—marker in a bit by bit manner. Whena complete match is found, decode( ) is finished and returns true. Ifthe sample stream is exhausted before this occurs, decode( ) returnsfalse. If decode( ) returns true, a valid message is stored in themessage buffer, including the start and end of message markers.

REFERENCES

The following references may be of use to those lacking skill in the artof steganography or the various cryptographic techniques discussed inthis document

-   Press, Flannery, Teukolsky, and Vetterling, Numerical Recipes in C,    Cambridge University Press, 1988-   12. Fourier Transform Spectral Methods, pgs. 398-470-   Ken C. Pohlmai, Principles of Digital Audio, 2nd ed., SAMS, 1991-   B. Schneier, Applied Cryptography, John Wiley & Sons, Inc. New York    1994 particularly the following sections for steganography:-   4.1 Subliminal Channel, pgs. 66-68-   16.6 Subliminal Channel, pgs. 387-392-   particularly the following sections for cryptography and digital    signatures-   Chapter 2: Protocol Building Blocks, pgs 28-41-   D. Kahn, The Code Breakers, The Macmillan Company, 1969 particularly    the following sections on steganography-   pgs xiii, 513,515-   U.S. Pat. Nos.-   U.S. Pat. No. 4,908,873 Philibert et al.-   U.S. Pat. No. 5,412,718 Narasimhalu, et al.-   U.S. Pat. No. 4,979,210 Nagata et al.-   U.S. Pat. No. 5,073,925 Nagata et al.-   U.S. Pat. No. 5,287,407 Holmes-   U.S. Pat. No. 4,980,782 Ginkel-   U.S. Pat. No. 5,408,505 Indeck, et al.-   U.S. Pat. No. 5,365,586 Indeck, et al.-   U.S. Pat. No. 4,200,770 Hellman, Diffie-   U.S. Pat. No. 4,218,582 M. E. Hellman and R. C Merkle-   U.S. Pat. No. 4,405,829 Rivest, Shamir, Adelman-   U.S. Pat. No. 4,748,668 Shamir, Fiat

1. A computer-based method for identifying digital content, the methodcomprising: receiving encoded digital content, wherein encoding of saidencoded digital content comprises a steganographic mapping process thatuses at least one of a plurality of keys; and decoding additionalinformation from the encoded digital content using at least one of theplurality of keys, and wherein the key is derived from the encodingprocess; wherein the additional information includes an encode hash ofat least a portion of the content and further comprising generating adecode hash of at least a portion of the content and comparing saidencode hash to said decode hash.
 2. The method according to claim 1,wherein the additional information includes at least one selected fromthe group consisting of: the title of the encoded content, the artist ofthe encoded content, terms of distribution of the encoded content,rights ownership identification of the encoded content, authorshipidentification of the encoded content, publication rights of the encodedcontent, ownership identification of the encoded content, and an audittrail of the encoded content.
 3. The method according to claim 1,wherein the additional information includes at least one selected fromthe group consisting of: information for enabling use of the encodedcontent, meterware information for the use of the encoded content,pay-by-use information for the use of the encoded content, and paymentinformation for access to the encoded content.
 4. The method accordingto claim 1, wherein the key locates and extracts the additionalinformation.
 5. The method according to claim 1, wherein the key isderived from the content.
 6. The method according to claim 1, whereinthe key is random or pseudo random.
 7. The method according to claim 1,wherein the additional information is encoded in at least two locationsof the content; and further comprising using said key to decode saidadditional information from at least one of the two locations of thecontent.
 8. The method according to claim 1, wherein said additionalinformation does not perceptibly affect the encoded content.
 9. Themethod according to claim 8, wherein the content comprises at least oneselected from the following group consisting of: an analog waveform,discrete digital samples, a digital sample stream, and a compressedversion of the encoded content.
 10. A computer-based method foridentifying digital content, the method comprising: receiving encodeddigital content, wherein encoding of said encoded digital contentcomprises a steganographic mapping process that uses at least one of aplurality of keys; and decoding additional information from the encodeddigital content using at least one of the plurality of keys, and whereinthe key is derived from the encoding process; wherein the additionalinformation includes a watermark comprising a one way function of atleast a portion of the content that contains the watermark, wherein theone way function is insensitive to the encoding of the additionalinformation; wherein the one way function generates at least oneselected from the following group consisting of: a hash, a signature, amessage digest and a certificate.
 11. The method according to claim 1,wherein the additional information contains a signed or encryptedwatermark.
 12. The method according to claim 1, wherein the content wasencoded by a process comprising at least one selected from the groupconsisting of: a steganographic process, an imperceptible encodingprocess, a watermarking process, a steganographic cipher process, and aninformation hiding process.
 13. A computer-based method for encodingadditional information into digital content, the method comprising:receiving digital content to be encoded; and encoding the additionalinformation into the digital content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the digitalcontent, and wherein the encoded additional information is unique to theencoded copy; wherein the additional information includes an encode hashof at least a portion of the content and further comprising generating adecode hash of at least a portion of the content and comparing saidencode hash to said decode hash.
 14. The method according to claim 13,wherein the key hides the additional information in at least onelocation in the content.
 15. The method according to claim 13, whereinthe key maps the additional information in at least one location in thecontent.
 16. The method according to claim 13, wherein the keydetermines the size of the additional information.
 17. The methodaccording to claim 16, wherein the size of the additional information ismeasured in bits.
 18. The method according to claim 13, wherein the keyis derived from features of the content.
 19. The method according toclaim 18, wherein the step of deriving a key from the content isinsensitive to the encoding process.
 20. The method according to claim13, wherein the additional information includes at least one selectedfrom the group consisting of: the title of the encoded content, theartist of the encoded content, terms of distribution of the encodedcontent, rights ownership identification of the encoded content,authorship identification of the encoded content, publication rights ofthe encoded content, ownership identification of the encoded content,and an audit trail of the encoded content.
 21. The method according toclaim 13, wherein the key is random or pseudo random.
 22. The methodaccording to claim 13, wherein the additional information includes atleast one selected from the group consisting of: information forenabling use of the encoded content, meterware information for the useof the encoded content, pay-by-use information for the use of theencoded content, and payment information for access to the encodedcontent.
 23. The method according to claim 13, wherein the additionalinformation is encoded in at least two locations of the content; andfurther comprising using said key to decode said additional informationfrom at least one of the two locations of the content.
 24. The methodaccording to claim 13, wherein said additional information does notperceptibly affect the encoded content.
 25. The method according toclaim 24, wherein the content comprises at least one selected from thefollowing group consisting of: an analog waveform, discrete digitalsamples, a digital sample stream, and a compressed version of theencoded content.
 26. The method according to claim 13, wherein theadditional information contains a signed or encrypted watermark.
 27. Themethod according to claim 13, wherein the encoding process comprises atleast one selected from the group consisting of: a steganographicprocess, an imperceptible encoding process, a watermarking process, asteganographic cipher process, and an information hiding process. 28.The method according to claim 13, wherein the additional information isencoded such that tampering with the additional information causesartifacts in the encoded content.
 29. The method according to claim 13,wherein the key is unique to at least a portion of the additionalinformation.
 30. A computer-based method for encoding additionalinformation into digital content, the method comprising: receivingdigital content to be encoded; and encoding the additional informationinto the digital content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the digitalcontent, and wherein the encoded additional information is unique to theencoded copy; wherein the additional information includes a watermarkcomprising a one way function of at least a portion of the content thatcontains the watermark, wherein the one way function is insensitive tothe encoding of the additional information; wherein the one way functiongenerates at least one selected from the following group consisting of:a hash, a signature, a message digest and a certificate.
 31. The methodaccording to claim 30, further comprising generating a decode hash of atleast a portion of the content that contains the watermark and comparingsaid encode hash to said decode hash.
 32. A computer-based method fortamper proofing digital content, the method comprising: calculating aone way function of additional information, the information comprisingdata to be encoded into the content and information based on thecontent, such that the one way function is insensitive to the changesintroduced into the content by the encoding process; and encoding theadditional information into the content using a mapping function thatselects one or more keys from a plurality of pre-established keys, andwherein the selected key comprises information derived from the encodingprocess.
 33. The method according to claim 32, wherein the one wayfunction generates at least one selected from the following groupconsisting of: a hash, a signature, a message digest, and a certificate.34. A non-transitory computer-readable medium having therein storedinstructions adapted to be executed by a processor, which instructionswhen executed result in a process comprising: receiving encoded content,wherein encoding of said encoded content comprises a steganographicmapping process that uses at least one of a plurality of keys; anddecoding additional information from the encoded content using at leastone of the plurality of keys, and wherein the key is derived from theencoding process; wherein the additional information includes an encodehash of at least a portion of the content and further comprisinggenerating a decode hash of at least a portion of the content andcomparing said encode hash to said decode hash.
 35. The medium of claim34, wherein the additional information includes at least one selectedfrom the group consisting of: the title of the encoded content, theartist of the encoded content, terms of distribution of the encodedcontent, rights ownership identification of the encoded content,authorship identification of the encoded content, publication rights ofthe encoded content, ownership identification of the encoded content,and an audit trail of the encoded content.
 36. The medium of claim 34,wherein the additional information includes at least one selected fromthe group consisting of: information for enabling use of the encodedcontent, meterware information for the use of the encoded content,pay-by-use information for the use of the encoded content, and paymentinformation for access to the encoded content.
 37. The medium of claim34, wherein the key locates and extracts the additional information. 38.The medium of claim 34, wherein the key is derived from the content. 39.The medium of claim 34, wherein the key is random or pseudo random. 40.The medium of claim 34, wherein the additional information is encoded inat least two locations of the content; and further comprising using saidkey to decode said additional information from at least one of the twolocations of the content.
 41. The medium of claim 34, wherein saidadditional information does not perceptibly affect the encoded content.42. The medium of claim 41, wherein the content comprises at least oneselected from the following group consisting of: an analog waveform,discrete digital samples, a digital sample stream, and a compressedversion of the encoded content.
 43. The medium of claim 34, wherein theadditional information contains a signed or encrypted watermark.
 44. Themedium of claim 34, wherein the content was encoded by a processcomprising at least one selected from the group consisting of: asteganographic process, an imperceptible encoding process, awatermarking process, a steganographic cipher process, and aninformation hiding process.
 45. A non-transitory computer-readablemedium having therein stored instructions adapted to be executed by aprocessor, which instructions when executed result in a processcomprising: receiving encoded content, wherein encoding of said encodedcontent comprises a steganographic mapping process that uses at leastone of a plurality of keys; and decoding additional information from theencoded content using at least one of the plurality of keys, and whereinthe key is derived from the encoding process; wherein the additionalinformation includes a watermark comprising a one way function of atleast a portion of the content that contains the watermark, wherein theone way function is insensitive to the encoding of the additionalinformation; wherein the one way function generates at least oneselected from the following group consisting of: a hash, a signature, amessage digest and a certificate.
 46. A non-transitory computer-readablemedium having therein stored instructions adapted to be executed by aprocessor, which instructions when executed result in a processcomprising: receiving content to be encoded; and encoding the additionalinformation into the content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the content, andwherein the encoded additional information is unique to the encodedcopy; wherein the additional information includes an encode hash of atleast a portion of the content and further comprising generating adecode hash of at least a portion of the content and comparing saidencode hash to said decode hash.
 47. The medium of claim 46, wherein thekey hides the additional information in at least one location in thecontent.
 48. The medium of claim 46, wherein the key maps the additionalinformation in at least one location in the content.
 49. The medium ofclaim 46, wherein the key determines the size of the additionalinformation.
 50. The medium of claim 49, wherein the size of theadditional information is measured in bits.
 51. The medium of claim 46,wherein the key is derived from features of the content.
 52. The mediumof claim 51, wherein the step of deriving a key from the content isinsensitive to the encoding process.
 53. The medium of claim 46, whereinthe additional information includes at least one selected from the groupconsisting of: the title of the encoded content, the artist of theencoded content, terms of distribution of the encoded content, rightsownership identification of the encoded content, authorshipidentification of the encoded content, publication rights of the encodedcontent, ownership identification of the encoded content, and an audittrail of the encoded content.
 54. The medium of claim 46, wherein thekey is random or pseudo random.
 55. The medium of claim 46, wherein theadditional information includes at least one selected from the groupconsisting of: information for enabling use of the encoded content,meterware information for the use of the encoded content, pay-by-useinformation for the use of the encoded content, and payment informationfor access to the encoded content.
 56. The medium of claim 46, whereinthe additional information is encoded in at least two locations of thecontent; and further comprising using said key to decode said additionalinformation from at least one of the two locations of the content. 57.The medium of claim 46, wherein said additional information does notperceptibly affect the encoded content.
 58. The medium of claim 57,wherein the content comprises at least one selected from the followinggroup consisting of: an analog waveform, discrete digital samples, adigital sample stream, and a compressed version of the encoded content.59. The medium of claim 46, wherein the additional information containsa signed or encrypted watermark.
 60. The medium of claim 46, wherein theencoding process comprises at least one selected from the groupconsisting of: a steganographic process, an imperceptible encodingprocess, a watermarking process, a steganographic cipher process, and aninformation hiding process.
 61. The medium of claim 46, wherein theadditional information is encoded such that tampering with theadditional information causes artifacts in the encoded content.
 62. Themedium of claim 46, wherein the key is unique to at least a portion ofthe additional information.
 63. A non-transitory computer-readablemedium having therein stored instructions adapted to be executed by aprocessor, which instructions when executed result in a processcomprising: receiving content to be encoded; and encoding the additionalinformation into the content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the content, andwherein the encoded additional information is unique to the encodedcopy; wherein the additional information includes a watermark comprisinga one way function of at least a portion of the content that containsthe watermark, wherein the one way function is insensitive to theencoding of the additional information; wherein the one way functiongenerates at least one selected from the following group consisting of:a hash, a signature, a message digest and a certificate.
 64. The mediumof claim 63, further comprising generating a decode hash of at least aportion of the content that contains the watermark and comparing saidencode hash to said decode hash.
 65. A non-transitory computer-readablemedium having therein stored instructions adapted to be executed by aprocessor, which instructions when executed result in a processcomprising: calculating a one way function of additional information,the information comprising data to be encoded into the content andinformation based on the content, such that the one way function isinsensitive to the changes introduced into the content by the encodingprocess; and encoding the additional information into the content usinga mapping function that selects one or more keys from a plurality ofpreestablished keys, and wherein the selected key comprises informationderived from the encoding process.
 66. The medium of claim 65, whereinthe calculated one way function generates at least one selected from thefollowing group consisting of: a hash, a signature, a message digest,and a certificate.
 67. A system for identifying content, the systemcomprising: a receiver for receiving encoded content, wherein encodingof said encoded content comprises a steganographic mapping process thatuses at least one of a plurality of keys; and a decoder, said decodercomprising at least one of(1) a CPU and non transitory memory storing adecode algorithm and (2) hardwired circuitry designed to execute saiddecode algorithm, said decoder designed to use said decode algorithm fordecoding additional information from the encoded content using at leastone of the plurality of keys, wherein the key is derived from theencoding process; wherein the additional information includes an encodehash of at least a portion of the content and further comprising agenerator for generating a decode hash of at least a portion of thecontent and a comparator for comparing said encode hash to said decodehash.
 68. The system according to claim 67, wherein the additionalinformation includes at least one selected from the group consisting of:the title of the encoded content, the artist of the encoded content,terms of distribution of the encoded content, rights ownershipidentification of the encoded content, authorship identification of theencoded content, publication rights of the encoded content, ownershipidentification of the encoded content, and an audit trail of the encodedcontent.
 69. The system according to claim 67, wherein the additionalinformation includes at least one selected from the group consisting of:information for enabling use of the encoded content, metewareinformation for the use of the encoded content, pay-by-use informationfor the use of the encoded content, and payment information for accessto the encoded content.
 70. The system according to claim 67, whereinthe decoder uses a key to locate and extract the additional information.71. The system according to claim 67, wherein the key is derived fromthe content.
 72. The system according to claim 67, wherein the key israndom or pseudo random.
 73. The system according to claim 67, whereinthe additional information is encoded in at least two locations of thecontent; and further comprising using said decoder to use said key todecode said additional information from at least one of the twolocations of the content.
 74. The system according to claim 67, whereinsaid additional information does not perceptibly affect the encodedcontent.
 75. The system according to claim 74, wherein the contentcomprises at least one selected from the following group consisting of:an analog waveform, discrete digital samples, a digital sample stream,and a compressed version of the encoded content.
 76. The systemaccording to claim 67, wherein the additional information contains asigned or encrypted watermark.
 77. The system according to claim 67,wherein the content was encoded by a process comprising at least oneselected from the group consisting of: a steganographic process, animperceptible encoding process, a watermarking process, a steganographiccipher process, and an information hiding process.
 78. A system foridentifying content, the system comprising: a receiver for receivingencoded content, wherein encoding of the encoded content comprises asteganographic mapping process that uses at least one of a plurality ofkeys; and a decoder, said decoder comprising at least one of(1) a CPUand non transitory memory storing a decode algorithm and () hardwiredcircuitry designed to execute said decode algorithm, said decoderdesigned to use said decode algorithm for decoding additionalinformation from the encoded content using at least one of the pluralityof keys, wherein the key is derived from the encoding process; whereinthe additional information includes a watermark comprising a one wayfunction of at least a portion of the content that contains thewatermark, wherein the one way function is generated by a generator,said one way function configured to be insensitive to the encoding ofthe additional information; further comprising a generator forgenerating a one way function selected from the following groupconsisting of: a hash, a signature, a message digest and a certificate.79. A system for encoding additional information into content, thesystem comprising: a receiver for receiving content to be encoded; andan encoder, said encoder comprising at least one of (1) a CPU and nontransitory memory storing an encode algorithm and (2) hardwiredcircuitry designed to execute said encode algorithm, said encoderdesigned to use said encode algorithm for encoding the additionalinformation into the content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the content, andwherein the encoded additional information is unique to the encodedcopy; wherein the additional information includes an encode hash of atleast a portion of the content and further comprising a generator forgenerating a decode hash of at least a portion of the content andcomparing said encode hash to said decode hash.
 80. The system accordingto claim 79, wherein the encoder uses at least one key to hide theadditional information in at least one location in the content.
 81. Thesystem according to claim 79, wherein the encoder uses the key to mapthe additional information in at least one location in the content. 82.The system according to claim 79, wherein the encoder uses the key todetermine the size of the additional information.
 83. The systemaccording to claim 82, wherein the size of the additional information ismeasured in bits.
 84. The system according to claim 79, furthercomprising a key generator, wherein the key is derived from features ofthe content.
 85. The system according to claim 84, wherein the keygenerator generates a key configured to be insensitive to the encodingprocess.
 86. The system according to claim 79, wherein the additionalinformation includes at least one selected from the group consisting of:the title of the encoded content, the artist of the encoded content,terms of distribution of the encoded content, rights ownershipidentification of the encoded content, authorship identification of theencoded content, publication rights of the encoded content, ownershipidentification of the encoded content, and an audit trail of the encodedcontent.
 87. The system according to claim 79, further comprising a keygenerator, wherein the key is random or pseudo random.
 88. The systemaccording to claim 79, wherein the additional information includes atleast one selected from the group consisting of: information forenabling use of the encoded content, meterware information for the useof the encoded content, pay-by-use information for the use of theencoded content, and payment information for access to the encodedcontent.
 89. The system according to claim 79, wherein the additionalinformation is encoded in at least two locations of the content; andfurther comprising a decoder for decoding the additional informationusing said key to decode said additional information from at least oneof the two locations of the content.
 90. The system according to claim79, wherein said additional information does not perceptibly affect theencoded content.
 91. The system according to claim 90, wherein thecontent comprises at least one selected from the following groupconsisting of: an analog waveform, discrete digital samples, a digitalsample stream, and a compressed version of the encoded content.
 92. Thesystem according to claim 79, wherein the additional informationcontains a signed or encrypted watermark.
 93. The system according toclaim 79, wherein the encoder for encoding comprises at least oneselected from the group consisting of: a steganographic encoder, animperceptible encoder, a watermarking encoder, a steganographic cipherencoder, and an information hiding encoder.
 94. The system according toclaim 79, wherein the additional information is encoded such thattampering with the additional information causes artifacts in theencoded content.
 95. The system according to claim 79, furthercomprising a generator for generating at least one key, wherein the keyis unique to at least a portion of the additional information.
 96. Asystem for encoding additional information into content, the systemcomprising: a receiver for receiving content to be encoded; and anencoder, said encoder comprising at least one of (1) a CPU and nontransitory memory storing an encode algorithm and (2) hardwiredcircuitry designed to execute said encode algorithm, said encoderdesigned to use said encode algorithm for encoding the additionalinformation into the content, wherein the encoding comprises asteganographic cipher process that uses at least one of a plurality ofkeys to generate at least one unique encoded copy of the content, andwherein the encoded additional information is unique to the encodedcopy; wherein the additional information includes a watermark comprisinga one way function of at least a portion of the content that containsthe watermark, wherein the one way function is generated by a generator,said one way function configured to be insensitive to the encoding ofthe additional information; further comprising a generator forgenerating a one way function selected from the following groupconsisting of: a hash, a signature, a message digest and a certificate.97. The system according to claim 96, further comprising a generator forgenerating a decode hash of at least a portion of the content thatcontains the watermark and comparing said encode hash to said decodehash.
 98. A system for tamper proofing content, the system comprising: aprocessor for calculating a one way function of additional information,the information comprising data to be encoded into the content andinformation based on the content, such that the one way function isinsensitive to the changes introduced into the content by the encodingprocess; and an encoder, said encoder comprising at least one of (1) aCPU and non transitory memory storing an encode algorithm and (2)hardwired circuitry designed to execute said encode algorithm, saidencoder designed to use said encode algorithm for encoding theadditional information into the content using a mapping function thatselects one or more keys from a plurality of predetermined keys, andwherein the selected key comprises information derived from the encodingprocess.
 99. The system according to claim 98, wherein the processorcalculates a one way function selected from the following groupconsisting of: a hash, a signature, a message digest, and a certificate.